CVE-2026-38651: Go Jwt Missing Validity Check
A JWT token parsed with `jwt.Parse` or `jwt.ParseWithClaims` is accessed by checking if it is non-nil without also verifying the token's validity (`token.Valid`) or checking the returned error. Invalid tokens (e.g., forged signatures) may still evaluate as non-nil, leading to authentication bypass. Always check `token.Valid` or ensure the parsing error is ha
Gogreprules fetch cve-2026-38651-go-jwt-missing-validity-check --engine opengrepDescription
A JWT token parsed with `jwt.Parse` or `jwt.ParseWithClaims` is accessed by checking if it is non-nil without also verifying the token's validity (`token.Valid`) or checking the returned error. Invalid tokens (e.g., forged signatures) may still evaluate as non-nil, leading to authentication bypass. Always check `token.Valid` or ensure the parsing error is ha
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.